{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "trivy",
    "label": "Trivy",
    "isStack": false,
    "url": "https://pwn.watch/t/trivy",
    "feed": "https://pwn.watch/t/trivy/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "teampcp-trivy-checkmarx-supply-chain",
      "title": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain",
      "json": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts",
      "tags": [
        "github-actions",
        "docker",
        "devtools",
        "github",
        "trivy",
        "checkmarx",
        "vscode",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Trivy v0.69.4; trivy-action before v0.35.0; setup-trivy before v0.2.6; Checkmarx AST v2.3.28; KICS before v2.1.20 (per vendor/CSA guidance)"
      ],
      "fixedVersions": [
        "trivy-action >= v0.35.0",
        "setup-trivy >= v0.2.6",
        "Checkmarx AST/KICS patched releases per Checkmarx updates"
      ],
      "startedAt": "2026-03-01",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Trivy compromise disclosed; Microsoft guidance published.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    }
  ]
}